Formalising investigative decision making in digital forensics: Proposing the Digital Evidence Reporting and Decision Support (DERDS) framework

Horsman, Graeme

doi:10.1016/j.diin.2019.01.007

Cited by 39 publications

(24 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Horsman [22] has proposed the Digital Evidence Reporting and Decision Support (DERDS) framework, which helps the investigator assess the soundness of her inferences, assumptions or conclusions on each step of the investigation. A similar approach has been presented by Beebe et al in [23] as a multi-tier objective framework for digital investigations.…”

Section: B Forensic Soundnessmentioning

confidence: 99%

“…Furthermore, in the absence of a standardized metric that can be used to valuate the cost C i of an attack action, the cost values have been assigned using a two-phase interviews process of practitioners, similarly to [22] and [30]. During the first phase, six structured interviews were conducted with experienced cybersecurity professionals to identify the criteria to be used for the cost valuation as well as the rating scale.…”

Section: Cost-benefit Parametersmentioning

confidence: 99%

See 1 more Smart Citation

Data-Driven Decision Support for Optimizing Cyber Forensic Investigations

Nisioti

Loukas

Lászka

et al. 2021

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Cyber attacks consisting of several attack actions can present considerable challenge to forensic investigations. Consider the case where a cybersecurity breach is suspected following the discovery of one attack action, for example by observing the modification of sensitive registry keys, suspicious network traffic patterns, or the abuse of legitimate credentials. At this point, the investigator can have multiple options as to what to check next to discover the rest, and will likely pick one based on experience and training. This will be the case at each new step. We argue that the efficiency of this aspect of the job, which is the selection of what next step to take, can have significant impact on its overall cost (e.g., the duration) of the investigation and can be improved through the application of constrained optimization techniques.Here, we present DISCLOSE, the first data-driven decision support framework for optimizing forensic investigations of cybersecurity breaches. DISCLOSE benefits from a repository of known adversarial tactics, techniques, and procedures (TTPs), for each of which it harvests threat intelligence information to calculate its probabilistic relations with the rest. These relations, as well as a proximity parameter derived from the projection of quantitative data regarding the adversarial TTPs on an attack life cycle model, are both used as input to our optimization framework. We show the feasibility of this approach in a case study that consists of 31 adversarial TTPs, data collected from 6 interviews with experienced cybersecurity professionals and data extracted from the MITRE ATT&CK STIX repository and the Common Vulnerability Scoring System (CVSS).

show abstract

Section: B Forensic Soundnessmentioning

confidence: 99%

Section: Cost-benefit Parametersmentioning

confidence: 99%

Data-Driven Decision Support for Optimizing Cyber Forensic Investigations

Nisioti

Loukas

Lászka

et al. 2021

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…Currently, digital reporting support and decision support systems (e.g. DERDS) are being actively developed to help professionals assess the reliability of inferences and assumptions about conclusions regarding any potentially evidence-based results [13].…”

Section: Blockchain Technologies In Digital Forensic Logisticsmentioning

confidence: 99%

Digital Forensic Logistics: The Basics of Scientific Theory

Zuev¹,

Bakhteev²

2021

IJLS

View full text Add to dashboard Cite

Investigations of complex crimes with digital evidence increasingly require the use of modern digital devices and computer programs. Working with big data involves the accumulation, processing, and analysis of forensic information for further algorithmization and modeling of investigative actions, as well as the automation of the organizational activities of investigators. The article substantiates the need for the use of digital forensic logistics to optimize information flows and build the most effective analytical human and computer processing, not excluding the use of artificial intelligence systems. Digital forensic logistics is a sub-branch of digital forensics in the collection, identification, storage, verification, and analysis of data, as well as the generation of electronic evidence for evidence in court. The article provides the main directions of digital forensic logistics, including the logistics of evidence in criminal cases; logistics of the general organization of crime investigation; logistics planning (selection of tools and methods of investigation); logistics of putting forward versions of events; logistics of decisions in criminal matters. It is argued that the efficiency of the entire system will largely depend on the establishment of information flows and the prioritization of tasks. Quality work requires the improvement of applied digital technologies capable of providing the necessary algorithms of the evidentiary process. The use of special software, including the use of artificial intelligence systems, is becoming increasingly relevant. The logistics of making decisions in criminal cases ideally represents an electronic assistant, endowed with artificial intelligence or in the form of a special computer program, capable, based on the determination of the forensic significance of the obtained digital information (electronic evidence), to offer the investigator solutions that can change the course of the investigation and transfer the entire information system in a new state.

show abstract

“…Horsman (2018) and Horsman (2019), on another viewpoint, discussed the need for admissible evidence in DF. Thus, they claimed that it is imperative that the results of any DF investigation should be reliable, based on scientific procedures and interpretation, and transformed into facts.…”

Section: Introductionmentioning

confidence: 99%

“…Interpretation of findings is another issue to be considered since a high level of scientific skill is required to interpret results and to provide evidence. Horsman (2018) and Horsman (2019), on another viewpoint, discussed the need for admissible evidence in DF. Thus, they claimed that it is imperative that the results of any DF investigation should be reliable, based on scientific procedures and interpretation, and transformed into facts.…”

mentioning

confidence: 99%

Experimentation of digital multimedia forensics: State of the art and research gaps

OliveiraJr

Zorzo

Neu

2020

WIREs Forensic Science

View full text Add to dashboard Cite

Digital multimedia forensics (DMF) plays an outstanding role in digital forensics (DF) area as it encompasses solutions for promoting image, audio, and video evidence to be used in court. As every science, one straightforward way of evolving is conducting formal experiments and providing reliable and auditable evidence. Therefore, in this article, we systematically map and analyze how experiments in DMF have been conducted and whether data-based evidence has been provided. This article presents a subset of results on DMF from a wider mapping study on DF experimentation. We then analyzed 49 experiments resulting from electronic and manual searches in widely known electronic databases and conferences/ workshops on DF. We used them to answer six research questions. We demonstrated that DMF needs to improve the way experiments are reported, especially how data are shared to allow reproducibility and, consequently, evolution of the research topic. We show that experimental elements, for example, hypothesis, variables, design, instrumentation, validity evaluation, setup, training, data sets and benchmarks, statistical techniques (descriptive, hypothesis, and effect size test), and limitations, should be better reported. As a general result, we understand DMF formal experimentation needs to evolve toward providing useful, reliable, auditable, and reproducible experimental evidence as both academia and practitioners might straightforward benefit from such evolution.

show abstract

Formalising investigative decision making in digital forensics: Proposing the Digital Evidence Reporting and Decision Support (DERDS) framework

Cited by 39 publications

References 10 publications

Data-Driven Decision Support for Optimizing Cyber Forensic Investigations

Data-Driven Decision Support for Optimizing Cyber Forensic Investigations

Digital Forensic Logistics: The Basics of Scientific Theory

Experimentation of digital multimedia forensics: State of the art and research gaps

Contact Info

Product

Resources

About